-
Notifications
You must be signed in to change notification settings - Fork 2.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[hackerone] Remove onion services from window.location.ancestorOrigins #32421
Labels
Projects
Milestone
Comments
25 tasks
fmarier
added a commit
to brave/brave-core
that referenced
this issue
Nov 3, 2023
mherrmann
pushed a commit
to brave/brave-core
that referenced
this issue
Nov 9, 2023
Verification
Steps:
Confirmed the results of the output match those provided in the test plan
|
Verified with
Verified the test plan from brave/brave-core#20622 (comment). Steps:
Confirmed the results of the output match those provided in the test plan
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The
window.location.ancestorOrigins
API is currently separate from any referrer interventions and so while we removed.onion
hostnames from cross-origin referrers, these.onion
hostnames are still visible via theancestorOrigins
API.We should follow a similar policy as what we did on the referrer side: omit
.onion
origins (replacing them with"null"
) unless they are same-origin with the innermost frame.Given the direction of whatwg/html#2480 and the fact that I already proposed changing the referrer in w3c/webappsec-referrer-policy#156, if Firefox ever implements this API, it will likely be done in the way that they have discussed publicly and then our implementation will be the natural way to fix this in the Tor browser too.
Originally reported on https://hackerone.com/reports/2117537 by xiaoyinl
The text was updated successfully, but these errors were encountered: